Element-Level Logging Support in nftables Sets

sontu mazumdar <[email protected]> Thu, 26 Jun 2025 09:57:54 +0530
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <CANgxkqwQpVQDM7AP20A0pCsGkPhte9tr-1gwdJJRVxqB9M2nng@mail.gmail.com>
Hi Everyone,

I am exploring whether it's possible to add logging support at the
element level within an nftables set. Specifically, I'm looking for
functionality where an individual element in a set can trigger a log
when it's matched—something like the following:

table inet mytable {
set s {
typeof ip saddr
counter
elements = { 1.1.1.1 log prefix "element1" level info,
                     1.1.1.3 log prefix "element2" level info }
        }
}

I understand that nftables sets currently do not support logging at
the element level. Is there any plan to introduce this feature in
future releases?

Regards,
Sontu